SEC04-BP02: Capture logs, findings, and metrics in standardized locations
Security operations teams require access to logs, findings, and metrics to investigate security events. Ensure that logs, findings, and metrics are captured in standardized locations and formats. For example, ensure that logs are sent to a centralized logging solution, and that findings from security services are sent to a centralized location such as AWS Security Hub.
Implementation guidance
Standardizing the collection and storage of logs, findings, and metrics is crucial for effective security operations. By centralizing these data sources in consistent formats and locations, you enable efficient analysis, correlation, and response to security events across your entire AWS environment.
Key steps for implementing this best practice:
- Establish centralized logging architecture:
- Design a centralized logging strategy for your organization
- Choose appropriate storage solutions for different log types
- Implement log aggregation from multiple sources
- Define standard log formats and schemas
- Establish log routing and distribution mechanisms
- Centralize security findings:
- Configure AWS Security Hub as your central findings repository
- Enable integration with all AWS security services
- Configure third-party security tools to send findings to Security Hub
- Implement custom findings for application-specific security events
- Standardize finding formats using AWS Security Finding Format (ASFF)
- Implement standardized metrics collection:
- Define security metrics and KPIs for your organization
- Use Amazon CloudWatch for centralized metrics storage
- Implement custom metrics for application security events
- Create standardized dashboards for security monitoring
- Set up automated alerting based on metric thresholds
- Configure cross-account log aggregation:
- Set up cross-account log delivery for multi-account environments
- Implement centralized log storage in a dedicated security account
- Configure appropriate IAM permissions for cross-account access
- Use AWS Organizations for simplified cross-account setup
- Implement log replication for high availability
- Implement data normalization and enrichment:
- Standardize log formats across different sources
- Implement log parsing and normalization
- Enrich logs with contextual information
- Implement correlation identifiers across log sources
- Use consistent timestamp formats and time zones
- Ensure data integrity and retention:
- Implement log integrity verification
- Configure appropriate retention policies
- Set up automated archival to cost-effective storage
- Implement backup and disaster recovery for log data
- Ensure compliance with regulatory retention requirements
Implementation examples
Example 1: Centralized logging with Amazon CloudWatch Logs
Example 2: AWS Security Hub configuration for centralized findings
Example 3: Standardized metrics collection with CloudWatch
Example 4: Cross-account log aggregation with AWS Organizations
AWS services to consider
Benefits of capturing logs, findings, and metrics in standardized locations
- Improved security visibility: Centralized view of security events across your entire environment
- Enhanced incident response: Faster correlation and analysis of security events
- Simplified compliance: Centralized audit trails and standardized reporting
- Operational efficiency: Reduced complexity in security monitoring and analysis
- Better threat detection: Improved ability to identify patterns and anomalies
- Cost optimization: Efficient storage and processing of security data
- Scalable architecture: Supports growth in data volume and organizational complexity